Subject: bug#76406: 31.0.50; Crash with tty child frames

From: Eli Zaretskii <[email-masked]>
Date: Thu, 20 Feb 2025 18:59:55 +0200

> Cc: [email-masked]
> From: Gerd Möllmann <[email-masked]>
> Date: Thu, 20 Feb 2025 15:21:04 +0100
> 
> The root frame ended up containing glyphs from a dead menu frame. The
> dead frame's face cache was set to NULL because it had been freed. The
> series of events leading to this is still unclear to me. At least we
> never copy glyphs from a dead frame, that much I can say.

Should deleting a frame on a TTY make sure there are no glyphs in the
root frame's current glyph matrix whose frame pointer refers to the
frame being deleted?